Best Practices for OSPs: Law Enforcement Information Requests

1. Best Practices for OSPs:Law Enforcement Information Requests Kurt Opsahl, Senior Staff Attorney Kevin Bankston, Staff Attorney

2. What kind of best practices? • Intermediaries that enable online speech can also become chokepoints to cut off that speech • Best practices for responding to • Law enforcement information requests • Civil subpoenas in a manner that protects ISPs and users

3. Overview: Responding to Legal Information Requests • How is your ISP classified under the law? • What information does your ISP have and what may be sought? • What legal process must be provided? • What procedures should your ISP employ in responding to requests?

4. Best Practices Best practices: • Require proper legal process • minimize logging • develop policy for user notice • establish record retention policy • internal training

5. What type is your ISP under ECPA? • The Electronic Communications Privacy Act defined two types of ISPs: • Electronic Communications Service to the extent you permit users to communicate with each other • Remote Computing Service to the extent you permit users to store communications or other information

6. What Information Do You Have? • Some things are obvious like Log Files, but not what they contain • May also store Email, User ID, Connection Info, Search Queries, URLs, Cookies, Unique Identifiers and IP Addresses • Other things?

7. Do You Need the Logs? • If you don’t have it, you can’t be forced to produce it • Can reduce compliance costs by minimizing information retained • Keep minimum logs for needs, and regularly delete unneeded information

8. Background: ECPA, SCA, Title III and FISA • Electronic Communications Privacy Act • Stored Communications Act • Title III is the Wiretap Act • Foreign Intelligence Surveillance Act

9. Background: ECPA • Electronic Communications Privacy Act amended the Wiretap Act to cover electronic communications (i.e. email) • SCA is part of ECPA

10. Background: SCA • The Stored Communications Act, regulates when an electronic communication service provider may disclose the contents of or other information about a customer’s emails and other electronic communications to third parties. • Contents of communications may not be disclosed to civil litigants even when presented with a civil subpoena.

11. Background: Title III • Title III makes it unlawful to listen to or observe the contents of a private communication without the permission of at least one party to the communication and regulates real-time electronic surveillance in federal criminal investigations. • Many states require all party consent

12. Background: FISA • The Foreign Intelligence Surveillance Act authorizes federal agents to conduct electronic surveillance, as part of a foreign intelligence or counterintelligence investigation, without obtaining a traditional, probable-cause search warrant

13. Classification of Information • Basic Subscriber Information (name, address, equipment identifier such as temporary IP address, and means and source of payment) • Other Information (clickstream, location) • Wiretap, Pen Register or Trap and Trace • Content - Real Time and Stored

14. Records of Videos Watched • The most highly protected piece of personal information under the law: • “information which identifies a person as having requested or obtained specific video materials or services from a video tape service provider” • Not limited to “tapes”, includes a/v material • Must be destroyed “as soon as practicable, but no later than one year from the date the information is no longer necessary” • Contact your legal counsel before disclosure pursuant to legal process

15. Location Information • Majority of courts require probable cause warrants for disclosure of real-time or prospective location information • DOJ asserts a lower standard • Contact your legal counsel before disclosure

16. Legal Standards • Basic Subscriber Information: Subpoena or better (Gov’t may not use civil subpoena) • Other Information: 2703(d) order or better • Dialed digits: Pen Register or better • Real Time Content: Title III order • Stored Content < 180 days: search warrant • Stored Content > 180 days: subpoena or better • Video records: Warrant or court order

17. Exception: Emergency Cases • Customer Information/Content Standard: ISP reasonably believes that an emergency involving immediate death or serious physical injury to any person requires disclosure of contents or justifies disclosure of records • Get the justification in writing

18. National Security Letters • FBI may compel the production of "subscriber information and toll billing records information, or electronic communication transactional records" through National Security Letters. • Generally NSLs must be kept secret • May contact legal counsel.

19. FISA Orders • Pursuant to FISA, the gov’t may provide FISA court order or other process under the Protect America Act • Contact legal counsel • EFF would love to challenge the PAA

20. A visit by Suits with Shades • If you get a personal visit from Law Enforcement, call your company’s lawyer. • Often, just an informal request for assistance • Safest course is to get legal counsel early

21. Provide Notice to Users • Best practice is to provide notice where possible - let user move to quash • LEAs need an order to prevent notice on subpoenas • Notice may be delayed under ECPA

22. Backup Preservation • Any LEA can request by any means • Notify LEA, but do not deliver info • LEA notifies user - starts 14 day clock for user objection • Absent objection, must provide data upon receipt of proper process

23. Reimbursement • Yes for subpoenas • Yes for technical assistance (not required to redesign, just help) • Yes for special requirements, backup preservation, etc • Yes for all civil requests

24. Provider Exception • Provider exception grants service providers the right "to intercept and monitor [communications] placed over their facilities in order to combat fraud and theft of service."

25. Accessible to Public • Privacy laws have an exception for electronic communication made through a system "that is configured so that . . . [the] communication is readily accessible to the general public.” • If information sought by LEA is publicly available, you can tell them to get it themselves • In some cases authentication may be required

26. Penalties and Safe Harbors • May face lawsuits for improper disclosure • You are protected from civil actions if you rely in “good faith” upon appropriate legal process • Do not disclose information without being sure you have the right process

27. Parting Thoughts • Always get it in writing to preserve immunities • Your ISP is not the agent of an LEA • State and Local rules may be more strict • If in doubt, ask the lawyers

28. Help Us Help You • Let us know when you receive questionable over-reaching requests 415.436.9333 kurt@eff.org, bankston@eff.org http://www.eff.org http://ilt.eff.org